(19) 


J 


(12) 


EuropSisches Patentamt 
European Patent Office 
Office europeen des brevets (11) EP 0 953 938 A2 

EUROPEAN PATENT APPLICATION 


(43) 

Date of publication: 

(51) IntCI. 6 : G06T1/00 


03.11.1999 Bulletin 1999/44 

(21) 

Application number: 99102530.5 


(22) 

Date of filing: 10.02.1999 


(84) 

Designated Contracting States: 

(72) Inventor: Wong, Ping Wan 


AT BE CH CY DE DK ES R FR GB GR IE IT LI LU 

Sunnyvale, Ca 94087 (US) 


MCNLPTSE 



Designated Extension States: 

(74) Representative: 


AL LT LV MK RO SI 

Schoppe, Fritz, Dipl.-lng. 



Schoppe, Zimmermann & StGckeler 

(30) 

Priority: 30.04.1998 US 70470 

Patentanwaite 



Postfach 71 08 67 

(71) 

Applicant: 

81458 MOnchen (DE) 


Hewlett-Packard Company 



Palo Alto, California 94304 (US) 



CM 

< 

GO 
CO 
O) 

CO 

m 


(54) A method and apparatus for digital watermarking of images 


(57) The present invention provides an invisible dig- 
ital watermarking technique that can serve the two pur- 
poses of ownership verification and authentication, that 
can detect changes in pixel values as well as image 
size, and that may be used in public key or alternatively, 
secret key watermarking systems. The watermark 
insertion procedure computes a hash function and then 
combines the output of the hashed function of a modi- 
fied image block, a key and various image parameters 
with a block of the watermark bitmap, resulting in a com- 
bined image block. As a final step to create a water- 
marked image block, the combined image block is 
inserted into the LSB of the modified image. The water- 
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mark extraction procedure takes the watermarked 
image block and creates two different image blocks: a 
first image block with the LSB's of the watermarked 
image block set to zero, and a second image block with 
the LSB's of the watermarked image block extracted. 
The watermark extraction procedure uses the hash 
function to calculate a digest of values, resulting in a 
hashed output. The hashed output is combined with the 
second image block, preferably using an exclusive OR 
function. The result of the combined hashed output with 
the second image block is a block of the extracted 
watermark. 
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Description 

BACKGROUND OF THE INVENTION 

[0001] Digital watermarking is a technique to insert a 5 
digital identifier into an image so that the identifier can 
be extracted for the purposes of ownership verification 
and/or authentication. By ownership verification, we 
mean that we can extract a digital identifier from a 
watermarked image that can be identified as being 10 
associated with a owner. Authentication refers to the 
fact that we can detect any change to the watermarked 
image. Digital watermarking is becoming increasingly 
important due to the popularity of the usage of digital 
images on the world wide web and in electronic com- is 
merce. 

[0002] From the perspective of an image viewer, 
watermarks can be classified into two categories: visible 
and invisible. Visible watermarking refers to the class of 
watermarking procedures where a visible stamp, e.g., a 20 
company logo, is inserted into an image. The stamp is 
visible in similar fashion as the watermark to current 
U.S. dollar bills. U.S. Patent No. 5,530,759, entitled 
"Color Correct Digital Watermarking of Images," to 
Braudaway et al. describes a method of inserting a visi- 25 
We watermark into an original digital image. Braudaway 
et al. teaches modifying the brightness or darkness of 
the original image based on the position of the water- 
mark. The watermark insertion and extraction method- 
ology described in Braudaway et al. includes a random 30 
noise component which increases the difficulty of 
removal of the watermark from the original image by 
anyone except the authorized user. 
[0003] An invisible watermark is a digital identifier 
added to a digital image so that the resulting image is 35 
visibly indistinguishable from the original unmarked 
image. The invisible signature can be extracted or 
detected through a sequence of image processing oper- 
ations on the digital image. The article "Secure Spread 
Spectrum Watermarking for Multimedia," Tech. Rep. 95- 40 
10, NEC Research Institute, 1995 by I. J. Cox, J. Kilian, 
T Leighton, and T. Shamoon, describes a method of 
inserting an invisible watermark into a digital image. The 
Cox article describes transformation of an original 
image into a frequency domain representation of the 45 
image. From the frequency transformed representation 
of the image, the method described in Cox picks N fre- 
quency components of the image that are visually 
important and inserts a watermarking signal into these 
frequency components of the original image as a water- so 
mark. 

[0004] One way to accomplish ownership verification 
is to associate a user key with a watermark so that the 
desired watermark can only be extracted from a water- 
marked image with the appropriate user key. Two con- ss 
verrtional watermarking methodologies include: (1) 
secret key watermarking, that requires that both the 
owner and receiver possess the same secret key and 
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(2) public key watermarking, that requires the use of two 
different keys: a private key, and a corresponding public 
key. The private key is known only to the owner. The 
public key need not be secret and is used by the 
receiver of the image to detect the watermark. A prob- 
lem with secret key watermarking is that key exchange 
must occur before the actual transmission, typically via 
a more expensive secret alternative path, or must be 
arranged when sender and receiver are proximate. 
[0005] In the article "An invisible watermarking tech- 
nique for image verification,", M.M. Yeung and F. Mint- 
zer, Proceedings of ICIP (Santa Barbara, CA), October 
1997, an authentication watermarking method is 
described for a secret key system. In the method 
described in the Yeung article, a secret key is used in 
combination with a random number generator to gener- 
ate a look up table. The look up table defines a water- 
mark extraction procedure, which in turn suggests a 
watermark insertion step through adjustments to the 
original image. In the watermark extraction step, the 
extracted watermark is compared to a known water- 
mark to determine if the original image has been modi- 
fied. Although, the technique described by Yeung can 
detect changes to the pixel values of a watermarked 
image, it does not detect changes in image size result- 
ing from cropping or certain scaling algorithms. 
[0006] A method of invisible watermarking that can be 
used both for purposes of ownership verification and 
authentication, that can detect changes in pixel values 
as well as image size, and that may be used in public 
key or alternatively, secret key watermarking systems is 
needed. 

SUMMARY OF THE INVENTION 

[0007] The present invention provides an invisible dig- 
ital watermarking technique that can serve the two pur- 
poses of ownership verification and authentication, that 
can detect changes in pixel values as well as image 
size, and that may be used in public key or alternatively, 
secret key watermarking systems. The present inven- 
tion includes a watermark insertion procedure used by 
the image owner and a corresponding extraction proce- 
dure used by the receiver of the image. The watermark 
insertion procedure computes a hash function of a mod- 
ified image block, a key and various image parameters, 
and then combines the hashed output with a block of 
the watermark bitmap, resulting in a combined image 
block. In the preferred embodiment, the modified image 
block is the original image block with its LSB's set to 
zero. As a final step to create a watermarked image 
block, the combined image block is inserted into a LSB 
of the modified image. 

[0008] The watermark extraction procedure takes the 
watermarked image block and creates two different 
image blocks: a first image block with the LSB's of the 
watermarked image block set to zero, and a second 
image block with the LSB's of the watermarked image 
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block extracted. The first image block, a key and various 
image parameters are used as inputs to the hash func- 
tion. Although the inputs to the hash function for the 
watermark extraction process are different than the 
inputs to the hash function for the watermark insertion 5 
process, the cryptographic hash functions used for both 
watermark insertion and extraction must be identical. If 
the hash functions are different, the watermark will not 
be able to be properly extracted and the extracted 
watermark image will appear as noise. w 
[0009] The watermark extraction procedure uses the 
hash function to calculate a digest of values, resulting in 
a hashed output. The hashed output is combined with 
the second image block, preferably using an exclusive 
OR function. The result of the combined hashed output is 
with the second image block is a block of the extracted 
watermark. 

[001 0] The previously described insertion and extrac- 
tion methodology may be used for secret key encryption 
where the same secret key is used for both watermark 20 
insertion and extraction. In an alternative embodiment, 
the methodology described is modified so that the integ- 
rity and ownership of the image can be verified using a 
public key. In this alternative embodiment, a public key 
encryption step is included after the step combining of 25 
the hashed function with the watermark bitmap for the 
watermark insertion procedure. In addition, for the 
watermark extraction procedure, a public key decryption 
step is included before the extraction of the watermark 
using the reversible exclusive OR logic function. In such 30 
a system, the owner of the image inserts a watermark 
using a private key K'. In the watermark extraction pro- 
cedure, any person can use the public key K (corre- 
sponding to the private key K 1 ) to extract a binary 
watermark, that will indicate any changes that have 35 
been made to the watermarked image. 
[001 1 ] The present invention provides authentication 
that detects any change to the watermarked image for 
both a secret key and public key watermarking system. 
Detection of change is important for example where an 40 
image is to be used as evidence for legal purposes and 
in electronic commerce of images, where the buyer of 
an image can be assured that no change to the image 
has occurred when the image is delivered from the 
seller to the buyer. If any part of the image is changed, 45 
the watermark extraction procedure, according to the 
present invention, will return an output that indicates the 
specific parts of the image that have been changed. If a 
watermarked image is cropped, then the extraction pro- 
cedure will also return an output that resembles random so 
noise, signifying the cropped image is not valid. 
[0012] A further understanding of the nature and 
advantages of the present invention may be realized 
with reference to the remaining portions of the specifica- 
tion and the attached drawings. 55 
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BRIEF DESCRIPTION OF THE DRAWINGS 

[0013] 

Figure 1 A shows a block diagram of the watermark 
insertion methodology according to a first embodi- 
ment of the present invention. 

Figure 1B shows a flowchart of the steps corre- 
sponding to the insertion methodology shown in 
Figure 1A. 

Figure 1C shows alternatives to step 152 of Figure 
1 B (modifying the image block X r ) 

Figure 2A shows a block diagram of the watermark 
extraction methodology that is used in combination 
with the insertion methodology shown in Figures 
1A, 1B, andlC. 

Figure 2B shows a flowchart of the watermark 
extraction procedure that is used in combination 
with the insertion methodology shown in Figures 
1A, 1B, and 1C. 

Figure 3 shows an original image before watermark 
insertion. 

Figure 4 shows an image watermarked using the 
watermark insertion methodologies described in 
Figures 1Aand 1B. 

Figure 5 shows the extracted watermark output 
image after application of the watermark extraction 
procedure of Figures 2A and 2B when a correct 
user key K is used. 

Figure 6 shows an extracted watermark output 
image resembling random noise that may occur for 
example, if an image is unmarked, an incorrect key 
is applied, or the original image is cropped. 

Figure 7 shows the watermarked image of Figure 4 
that has been modified by the inclusion of a glass. 

Figure 8 shows the extracted watermark from Fig- 
ure 7 indicating the specific area where the modifi- 
cation to the watermarked image (the addition of a 
glass) have been made. 

Figure 9A shows a block diagram of the watermark 
insertion methodology according to a second 
embodiment that implements a public key system. 

Figure 9B shows a flowchart of the steps corre- 
sponding to the insertion methodology shown in 
Figure 9 A. 
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Figure 10A shows a block diagram of the water- 
mark extraction methodology that is used in combi- 
nation with the insertion methodology shown in 
Figures 9A and 9B. 

Figure 10B shows a block diagram of the water- 
mark extraction methodology that is used in combi- 
nation with the insertion methodology shown in 
Figure 9A and 9B. 

Figure 1 1 shows a summary of the experimental 
results summarizing the properties of the secret 
key verification methodology shown in Figures 1A 
and 1B. 

Figure 12 shows a summary of the experimental 
results summarizing the properties of the public 
key verification methodology shown in Figures 9A 
and 9B. 

Figure 13 shows a high-level block diagram of a 
computer system adapted to execute a software 
program implementing the steps of the watermark 
insertion methodology according to the present 
invention. 

DETAILED DESCRIPTION OF THE PREFERRED 
EMBODIMENTS 

[001 4] The present invention provides a technique for 
embedding and extracting a digital identifier into an 
image X mn of M x N pixels, to form a watermarked 
image V m n of the same size. Figures 1 A and 1B show 
a watermark insertion methodology according to a first 
embodiment of the invention. Figures 2A and 2B show a 
watermark extraction methodology according to a first 
embodiment of the invention. The watermark extraction 
methodology shown in Figures 2A and 2B should be 
used in conjunction with the watermark insertion meth- 
odologies shown in Figures 1 A and 1 B. 
[0015] Referring to the block diagram in Figure 1 A, 
shows a block diagram for implementing the watermark 
insertion procedure. Figure 1 B shows a flowchart of the 
steps corresponding to the insertion methodology 
shown in Figure 1A. Referring to Figure 1 A, an appara- 
tus 100 for implementing the insertion of a watermark 
into an original input digital image according to the 
present invention would include: a means for modifying 
1 1 0 at least one predetermined bit in an image block X n 
wherein the modified image block is X,.; a means for cal- 
culating a digest of values 112 using a cryptographic 
hash function, wherein the means for calculating a 
digest of value outputs a hashed output 114, wherein 
the means for modifying 1 1 0 at least one predetermined 
bit of the image block is electrically coupled to the 
means for calculating a digest of values 112; a means 
for combining 1 16 the hashed output 1 14 with a water- 
mark 118, wherein the means for combining 116 the 


hashed output 1 14 with a watermark 118 is electrically 
coupled to the means for calculating a digest of values 
112, wherein the output of the means for combining is a 
combined image block; and a means for inserting 126 

5 the combined image block (C r ) into the modified image 
block Xp wherein the means for inserting 126 the com- 
bined image block (C r ) into the modified image block Xp 
is electrically coupled to the means for modifying 1 10 at 
least one predetermined bit of the image block. 

10 [0016] Referring to the flowchart of Figure 1 B, in the 
preferred embodiment the method for inserting a water- 
mark into a digital original input image including the 
steps of: partitioning the image block X r into at least one 
I x J block (step 150); for each I x J block, modifying at 

is least a predetermined bit of the block to a predeter- 
mined value (step 152), wherein the modified image 
block is X,; calculating a digest of the values using a 
cryptographic hash function (step 154); combining the 
hashed output calculated in the previous step with a 

20 watermark bitmap B r (step 156), wherein the output of 
the step of combining the hashed output with a water- 
mark B r is an combined image block C r ; and inserting 
the value C r into the modified image & (step 158). 
[0017] The steps shown in Figure 1 B correspond to 

25 the implementation blocks shown in Figure 1A. For 
example, the step of calculating a digest of values (step 
154) corresponds to the implementation block 112 in 
Figure 1A. In other words, the step of calculating a 
digest of values is performed by block 112. Similarly, 

30 step 152 corresponds to block 110, step 156 corre- 
sponds to block 1 16 and step 158 corresponds to block 
1 26. Although Figure 1 B shows a flowchart of the steps 
in Figure 1A, the block diagram shown in Figure 1A 
clearly shows the inputs and outputs resulting from 

35 each step and the sequence of steps. 

[0018] The input to the means for setting a predeter- 
mined bit to a predetermined value is a block of the orig- 
inal input image X m n . In the preferred embodiment the 
original input image X m n is a gray scale image of size M 

40 x N. In an alternative embodiment, the original input 
image is color image. In the case of a color image, the 
same technique shown in Figures 1A, 1B, 1C, 2 A, 2B, 
9A, 9B, 10A, and 10B can be applied independently to 
the color planes of the image, either in the RGB color 

45 space or in any other color space such as for example, 
YUV. 

[001 9] In the preferred embodiment the image X m n is 
partitioned into blocks of / x J pixels. In one embodi- 
ment, the partitioned blocks in this application the 

50 blocks described are 8x8, although other block sizes 
are possible. Further, the step of partitioning the original 
image into I x J pixel blocks may be eliminated (this is 
equivalent to partitioning the image into one block, the 
image block having a block size where l=M and J=N ). 

55 However, having one block for the entire image is not 
desirable. Partitioning the original input image helps 
maintain localization when authenticating an image. 
Further, partitioning helps the viewer of the image more 
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clearly see the location where changes in the image 
have occurred. 

[0020] Let a mn be a bi-level image that represents the 
watermark to be embedded in X mn Note that a m>n need 
not be of the same size as From a m n we can form 5 
another bi-level image b mn of size MxN (same size as 
X mn ). There are many ways of transforming the image 
a m [ n into an image the same size as X m n . For example, 
b m,n mav be f° rm ed by tiling a m n , i.e., periodically rep- 
licating a m n to the desired size. Another possibility is to w 
append all zeros (or all ones) to the boundary of a m n so 
that we obtain b m n of the desired size. 
[0021] For an original input image X m n partitioned 
into I x J pixel blocks, let 

15 

X r *{x fhNM :0&k£l-1;0&h:J-1} 

be a block of size / x J taken from the image X m n . For 
simplicity, we are using a single index r to denote the I th 
block in the image. The corresponding block within the 20 
binary image b m n for the watermark bitmap 118 is 
denoted 

B r ={b ih qj +l :0ztel-1;0zkJ-1}. 

25 

Note that / and J can be any number provided they sat- 
isfy U<,p t where p is the size of the hash function 1 12. 
[0022] The input to the means for modifying 1 10 at 
least one predetermined bit of a image block to a prede- 
termined value is a rth block of the image X m n . In the 30 
preferred embodiment, the bit being set is the LSB of 
the block. Modifying the LSB of the block causes the 
least visible image distortion, an important factor for an 
invisible watermark. Although the embodiment shown in 
Figure 1 A is preferred, other alternative methodologies 35 
for modifying the image block X r available. However, 
even if alternative methodologies are implemented, it is 
critical that the identical methodology for modifying the 
image block X r (means 110, step 152a) in the water- 
mark insertion process must also be used for modifying 40 
the watermarked image block Y r (means 210, step 
252a) for the watermark extraction process shown in 
Figures 2A and 2B. 

[0023] In the embodiment shown in Figure 1A, the 
image block X r is modified by setting the LSB of the 45 
image block to zero. In an alternative embodiment of the 
embodiment implemented in step 152, a bit other than 
the LSB (or alternatively a group of bits) may be set to a 
predetermined value. In the embodiment shown in Fig- 
ure 1A, the predetermined value is zero, although the so 
value determined by the system designer may be 
changed. As previously described, although the value of 
the predetermined value and the bit location of the pre- 
determined bit may be changed by the system designer, 
it is critical that the same predetermined bit and prede- 55 
termined value used in the watermark insertion proce- 
dure defined in Figure 1A should also be used in the 
watermark extraction procedure defined in Figures 2A 
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and 2B. In other words, if the means for setting a prede- 
termined bit 1 10 of the block of the original input image 
to a predetermined value uses the LSB of the image as 
its predetermined bit and the value zero as its predeter- 
mined value, then the means for setting a predeter- 
mined bit 210 in Figure 2A should use the LSB of the 
image as its predetermined bit and the value zero as its 
predetermined value. 

[0024] Figure 1 C shows various alternatives for mod- 
ifying the image block X r . In a first embodiment (as 
shown in Figure 1 A), for each block, a predetermined bit 
of the image block X r is set to a predetermined value. 
However, in an alternative embodiment, for each block a 
predetermined bit(s) would be discarded (step 152b). If 
a predetermined bit(s) is discarded, it is this predeter- 
mined bit(s) that the combined image block C r is prefer- 
ably inserted in. In a third alternative embodiment, the 
image block could be modified according to a pattern of 
bits (step 152c). If a predetermined block is modified 
according to a pattern, it is this pattern of bit(s) that the 
combined image block C r is preferably inserted in (step 
158). Figure 1C shows only three possible alternatives 
for modifying the image block X P Other alternatives for 
modifying the image block X r are possible. What is criti- 
cal is that the image block X r be modified. Preferably, at 
least a portion of the combined image is inserted into 
the modified bits of the modified image block X,, 
[0025] The output of the means for modifying a prede- 
termined bit of the block of the image block is Xp Xr is 
input to both the means for calculating a digest of values 
K, M, N ^ using a cryptographic hash function and a 
means for inserting C r into a predetermined bit of Xp 
Referring to Figures 1 A and 1 B, the inputs to the means 
for calculating a digest of values using a cryptographic 
hash function are K (user key), & (modified image 
block), M (the width of the original input), and N (the 
height of the original input block). 
[0026] Referring to Figures 1 A and 1 B show the step 
of calculating a digest of the values K, M, N, X, using a 
cryptographic hash function. The cryptographic hash 
function may be chosen from a variety of hash func- 
tions. In the preferred embodiment, the well known MD5 
function or a variant thereof is used. The MD5 function 
is described, for example, in the article The MD5 Mes- 
sage Digest Algorithm," R.L Rivest, Internet RFC 1321 , 
April 1992. For the rest of this disclosure, we will use 
MD5 as our hash function although in alternative 
embodiments, other cryptographic has functions may 
also be used. 

[0027] In the embodiment described by the present 
invention , K is the secret encryption key, X,. is the mod- 
ified original input image block, M is the width of the 
original input image, and N is the height of the original 
input image. Consider a cryptographic hash function 

H(S)=(d v d 2 , d p ) 

where S represents a string of data of arbitrary length, 
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dfc are the binary output bits of the hash function, and 
p is the size of the output bit string. It has the property 
that given an input bit string S and its corresponding 
output (d 1r .,dp) % it is computationally infeasible to find 
another input bit string of any length that will be hashed 5 
to the same output (d 1r .., dp). Using the MD5 hash 
algorithm, any data string may be hashed into a bit array 
of length 128, ie., p = 128. If another cryptographic func- 
tion is used, the length p may be different. In the pre- 
ferred embodiment, the inequality p£ IJ is satisfied. 10 
[0028] Let K be a user key consisting of a string of 
bits. In the preferred embodiment, for each block of data 
X r we form the corresponding block 2& where each ele- 
ment in Xr equals the corresponding element in X r 
except that the least significant bit is set to zero. We 15 
compute for each block the hash 

H(K, M, N, X r ) = (d r p d r 2 ,..., d r p). 

[0029] Then, we select the first IJ bits in the hashed 20 
output and form the rectangular array d m n of size / x J. 
[0030] The hashed output d (<f 1t d r 2 , d r p) and a 
block of the watermarked bitmap B r are inputs into the 
means for combining the hashed output with a water- 
mark. The process for extracting and inserting a water- 25 
mark both include the step of combining the hashed 
output with the watermark B r The step of combining the 
hashed output 1 14 with the watermark 1 18 is performed 
using a bitwise logical operation. This allows easy 
processing for both the watermark insertion and extrac- 30 
tion processes. In the preferred embodiment, and as 
shown in Figures 1A and 1B, the bitwise logical opera- 
tion is an exclusive or function. 
[0031 ] Referring to Figure 1 A, the hashed output array 
is combined with B r to form a new binary block C T using 35 
a pixel by pixel exclusive OR operation. That is, we form 

where <B is the exclusive OR operation, and c m n are the 40 
elements in C r b m n are the elements in B r and d-, are the 
elements of the hashed output d. 
[0032] In the preferred embodiment, the final step 
before the creation of the watermarked image is insert- 
ing the value C r into the modified image Xp In the mod- 45 
rfied image block Xr- at least one bit of the image block 
is set to a predetermined value. Typically, C r is only 
inserted in bits that have been modified. Although pref- 
erably, each bit that has been modified corresponds to 
an insertion bit of C p in an alternative embodiment, a bit so 
C r does not correspond to each modified bit of the 
image block and therefore a value of C r is not inserted 
into every modified bit. In the preferred embodiment, 
where the LSB's of the image block are modified to be 
set to zero, and C r is inserted into the LSB of X,., a value 55 
of C r is inserted into each modified bit. 
[0033] In the preferred embodiment, we put c m n , into 
the least significant bit of the block 2C- to form the output 


block Y r This procedure is repeated for each block of 
data, and all the output blocks Y r are assembled 
together to form the watermarked image Y mn . The 
combined output block C r and the modified image X, are 
inputs into a means for inserting C r into a predeter- 
mined bit of X,. The output of the means for inserting C r 
into a predetermined bit of X, is the output image block 
Y r The output image block Y r is a watermarked image 
block. 

[0034] Referring to Figure 2A shows a block diagram 
200 of the watermark extraction methodology that may 
be used in combination with the insertion methodology 
shown in Figures 1 A and 1 B. The watermark extraction 
process extracts the watermark B r from the image block 
Y r to retrieve the watermark. Referring to Figure 2A, the 
watermark extraction apparatus includes a means for 
modifying at least a predetermined bit to a predeter- 
mined value 210; a means for extracting a predeter- 
mined bit from the watermarked image block Y r ; a 
means for calculating a digest of values using a crypto- 
graphic hash function, wherein the means for modifying 
a predetermined bit 210 is electrically coupled to the 
means for calculating a digest of values 212; and a 
means for combining 216 the hashed output value 214 
with the extracted image block E n wherein the means 
for combining 216 the hashed output value 214 with the 
extracted image block E,220 is electrically coupled to 
the means for extracting 218 a predetermined bit from 
the watermarked image block Y r 
[0035] Referring to Figure 2A and the flowchart shown 
in 2B shows a method of extracting a watermark from a 
digital image Y r , including the steps of: for each I x J 
block, modifying at least a predetermined bit of the 
watermarked image Y r to a predetermined value (step 
252), wherein the modified watermarked image Y r is Y,; 
extracting at least a predetermined bit from the water- 
marked image (step 254); calculating a digest of the val- 
ues using a cryptographic hash function (step 256); 
combining the hashed output with the image block E r 
[0036] Referring to Figure 2A, the inputs to the block 
for calculating a digest of the values K, M, N, Y, using a 
cryptographic hash function are K( the user key), M (the 
image width of the original image), and N (the image 
height of the original image) and Y^the watermarked 
image block modified to set a predetermined bit of an 
image block to a predetermined value). Thus, the step 
of modifying a predetermined bit (step 252) of the 
watermarked image block to a predetermined value, 
must be performed before the step of calculating a 
digest of the values (step 256) K, M, N, Y, using a cryp- 
tographic hash function. 

[0037] After we have obtained the extracted water- 
mark, the extracted watermark can be compared (visu- 
ally, via a computer image comparison program, etc.) to 
an appropriate watermark. For example, the appropri- 
ate watermark may be an image transmitted to the 
receiver at an earlier time for watermark comparison 
purposes. If there is deviation between the two water- 
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marks, then the locations of the deviations indicate the 
regions within the watermarked image that have been 
changed. 

[0038] Figures 3-8 more clearly shows the properties 
exhibited by images created using the watermarking 
methodology according to Figures 1A, 1B, 2A and 2B. 
For example, Figures 3 and 4 clarify that the watermark- 
ing method described by the present invention imple- 
ments an invisible watermark. Referring to Figure 3 
shows an original image before the watermark inser- 
tion. Figure 4 shows a watermarked image that has 
been watermarked using the watermark insertion meth- 
odologies described in Figures 1 A and 1 B. Comparing 
the Figures 4 and 3, it can be seen that the watermark 
produced is an invisible watermark since there is no vis- 
ually observable difference between the two images. 
[0039] Another property clearly exhibited by Figures 5 
and 6 is that a correct user key is required for the extrac- 
tion of a proper watermark. If one uses the correct user 
key K and applies the watermark extraction procedure 
to Figure 4, one obtains an output image Figure 5, indi- 
cating the presence of a proper watermark. In contrast, 
Figure 6 shows an output image resembling random 
noise that may occur for example, if an image is 
unmarked, an incorrect key is applied, or the original 
image is cropped. If an image is unmarked, i.e., if it does 
not contain a watermark, the watermark extraction pro- 
cedure returns an output that resembles random noise 
as shown in Figure 6. Similarly, if one applies an incor- 
rect key (for example, if one does not know the key), 
then the watermark extraction procedure returns an out- 
put that resembles random noise. As another example, 
if a watermarked image is cropped and then one applies 
the watermark extraction procedure on this cropped 
image, the output would resemble random noise. 
[0040] Figure 7 shows the watermarked image of Fig- 
ure 4 that has been modified by the inclusion of a glass. 
Figure 8 shows the extracted watermark from Figure 7 
indicating the specific area where the modification to the 
watermarked image (the addition of a glass) have been 
made. If one changes certain pixels in the watermarked 
image, then the specific locations of the changes are 
reflected at the output of the watermark extraction pro- 
cedure. Figure 7 shows an image where a glass is 
pasted onto Figure 4. Figure 8 shows the extracted 
watermark from Figure 7, indicating the specific area 
where changes have been made. 
[0041] A question that arises is that whether the 
watermark is secure if it is put into the least significant 
bit of the image. Recall that this watermark is designed 
for authentication purposes, i.e., to detect any change 
to the image. If someone attempts to remove the water- 
mark by changing some bit planes of the image, the 
watermark extraction procedure will detect the changes. 
[0042] A very important issue is whether it is possible 
for someone to forge a watermark into the scheme. 
Consider an image block B r Suppose someone wants 
to alter some or all of the pixels in this image block so 


that it becomes 8,. It is necessary that the pixel values 
in the two image blocks satisfy 

H(K, M, N, B r ) = H(K, M, N, B r ). 

5 

[0043] That is, the digest generated from both image 
blocks must be identical. This is considered computa- 
tionally infeasible because of the properties of crypto- 
graphic hash functions such as the MD5 algorithm. 

w [0044] In the first embodiment (described and shown 
in Figures 1A, 1B, 1C, 2 A, 2B and the accompanying 
. text), watermark insertion and extraction is described 
for a secret key system. A second embodiment 
(described and shown in Figures 9A, 9B, 10A, 10B and 

is the accompanying text in the specification) provides 
watermark insertion and extraction for a public key sys- 
tem. 

[0045] Figure 9A shows a block diagram of an elec- 
tronic system for implementing the insertion of a water- 

20 mark into an original input digital image for a public key 
system. The block diagram shown in Figure 9A is a 
modified version of the system shown in Figure 1A, 
where the modifications have been made to include 
public key encryption. Similarly, the block diagram 

25 shown in Figure 1 0A is a modified version of the system 
shown in Figure 2A except that the extraction methodol- 
ogy shown in Figure 10A has been modified to include 
public key decryption. 

[0046] Except for the modifications made for the pur- 

30 poses of including public key encryption (for example, 
the inputs to the hash function and electrical connec- 
tions have been modified), in general the statements 
made with respect to Figures 1A, 1B, 1C can also be 
made with respect to Figure 9A and 9B. Similarly state- 

35 ments made with respect to Figures 2A and 2B apply 
with respect to Figures 10A and 10B. For example, the 
statement made with respect to Figure 1A, that the 
image block Xr may be modified according to the alter- 
natives shown in Figure 1 C, is also true for Figure 9A 

40 (the implementation block 91 0 may be modified accord- 
ing to the alternatives shown in Figure 1 .) 
[0047] Figure 9A shows a block diagram of the water- 
mark insertion methodology according to a second 
embodiment that implements a public key system. Fig- 

45 ure 9B shows a flowchart of the steps corresponding to 
the insertion methodology shown in Figure 9A. Similar 
to the image defined in the first embodiment, for the 
public key system we assume a grayscale image X m n 
having a size of M by N pixels. We want to insert a 

so binary invisible Watermark image b m n to x m n to obtain 
the watermarked image Y m n . Similar to the first embod- 
iment, watermark insertion and extraction is performed 
on blocks of image data. For convenience, we chose the 
image block size to be 8 by 8. 

55 [0048] Referring to Figure 9A, the apparatus for inser- 
tion of watermark for a public key system includes: a 
means for modifying at least a predetermined bit of the 
image block X r 910; a means for calculating a digest of 
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values using a cryptographic hash function 912, 
wherein the means for calculating a digest of value out- 
puts a hashed output P r 914, wherein the means for 
modifying 910 at least a predetermined bit of the image 
block is electrically coupled to the means for calculating 5 
a digest of values 912; a means for combining 916 the 
hashed output with a watermark, wherein the means for 
combining 916 the hashed output with a watermark is 
electrically coupled to the means for calculating a digest 
of values 912; a public key encryption means 922 elec- w 
trically coupled to the means for combining 916 the 
hashed output and watermark; and a means for insert- 
ing 926 the encrypted output and watermark (W r ) into 
the predetermined bit of the block of the image 
wherein the means for inserting W r is electrically cou- 15 
pled to the means for modifying 910 at least a predeter- 
mined bit the image block. 

[0049] Figure 9B shows a flowchart of the steps cor- 
responding to the insertion methodology shown in Fig- 
ure 9A. Referring to the flowchart of Figure 9B, the 20 
method for inserting a watermark into a digital original 
input image for a public key system includes the steps 
of: partitioning the original image X r into I x J blocks 
(step 950); for each I x J block, modifying at least a pre- 
determined bit of the image block (step 952), wherein 25 
the modified image is X,; calculating a digest of the val- 
ues using a cryptographic hash function (step 954); 
combining the hashed output calculated in the previous 
step with a watermark B, (step 956), wherein the output 
of the step of combining the hashed output with a water- 30 
mark B r is a combined image C r ; encrypting the com- 
bined image C r (step 958), wherein the encrypted 
image is W r ; and incorporating the value W r into the 
modified image block is 2^ 

[0050] Similar to the methodology described for water- 35 
mark insertion for a secret key system, we let X r 
denotes the r^ block of data within the image x m n . 
Next, a corresponding block X, is formed where each 
element in X, equals the corresponding element in X r 
except that a predetermined bit (the least significant bit) 40 
is set to a predetermined value zero. H( • ) be a crypto- 
graphic hash function such as the MD5 algorithm. The 
hash function is computed as follows: 

H(M,N,X r ) = (p r v p r 2 p r s ) 45 

where ffj denotes the output bits from the hash func- 
tion, and s is size of the output bits that is dependent on 
the specific hash function used. For example, s =128 for 
MD5. so 
[0051 ] Denoting the first IJ bits from the bit stream P n 
i.e., 


P r is combined with a corresponding block B r in b, 


using a bitwise logic function, typically an exclusive or 
function. That is, we compute C r = P r © B r where © 
denotes the element-wise exclusive OR operation 
between the two blocks. Finally we encrypt C r with a 
public key cryptographic system to give 

W,*E K .(C r ) 

where E(* ) is the encryption function of the public key 
system, and K' is the private key. The binary block of 
data W r is then embedded into the least significant bit of 
the data block X^ to form a block Y r in the watermarked 
image. 

[0052] Figure 10A shows a block diagram of the 
watermark extraction methodology that is used in com- 
bination with the insertion methodology shown in Fig- 
ures 9A and 9B. Figure 10B shows a flowchart of the 
watermark extraction methodology used in Figure 1 0A. 
The apparatus shown in Figure 10A includes: a means 
for modifying 1010 at least a predetermined bit of a 
block of the watermarked image Z r to a predetermined 
value, wherein the modified image block is Z,; a means 
for extracting 1018 a predetermined bit from the image 
Z r ; a means for calculating a digest of values 1012 using 
a cryptographic hash function, wherein the means for 
modifying 1010 at least a predetermined bit is electri- 
cally coupled to the means for calculating a digest of 
values 1012; a public key decryption means 1020, 
wherein the output of the public key decryption means is 
a decrypted image block U n wherein the public key 
decryption means 1020 is electrically coupled to the 
means for extracting 1018; and a means for combining 
1016 the hashed output value with the decrypted image 
block U n wherein the means for combining the hashed 
output with the modified image block Z, is electrically 
coupled to the public key decryption means 1020 and 
the means for calculating a digest of values 1012. 
[0053] In the extraction procedure, the image block Z r 
is used to create two different images. In the preferred 
embodiment, the first image G r contains the least signif- 
icant bits, and the other image contains the pixel val- 
ues except that the least significant bits have been 
zeroed out. We then calculate the hash of M, N and Z,, 
and denote the first IJ bits of the output by Q r We use a 
public key decryption algorithm to decrypt G r with the 
public key Kthat corresponds to the private key K* used 
in the watermark insertion procedure. That is, we calcu- 
late 

U r =D(G r ). 

Finally, we compute the output block O r = Q r © U r 
using an element-wise exclusive or procedure. 
[0054] In our implementation of the public key water- 
mark insertion and extraction procedures, we used the 
MD5 as our hash function, and the RSA public key 
encryption algorithm for encryption and decryption. If 
both the watermarked image block and the image size 


8 


15 


EP0 953 938 A2 


16 


had not been changed since the insertion of a water- 
mark, i.e.. if Z T = Y r , then Z r = X r and G r =W r . This 
implies P r = Q r and U,= C f . Hence the output 
binary image O r , is identical to the block B r Otherwise, 
this will not be the case and the output block O r will 5 
appear similar to random noise due to the nature of the 
hash function. As a result, this algorithm can detect any 
change to the pixel values to the block level. 
[0055] Figure 10A shows a block diagram of the 
watermark extraction methodology that is used in com- 10 
bination with the insertion methodology shown in Figure 
9A and 9B. Referring to 10B shows a method of extract- 
ing a watermark from a digital image Y r , for a public key 
encryption system, including the steps of: for each I x J 
block, modifying at least a predetermined bit of the 15 
watermarked image Z r to a predetermined value (step 
1050), wherein the modified watermarked image Z r is 
Z?\ extracting at least a predetermined bit from the 
watermarked image Zp wherein the extracted image 
block (step 1 054) is G r ; calculating a digest of the values 20 
using a cryptographic hash function (step 1052); 
decrypting G r using a public key decryption function 
Dk(*). wherein the decrypted image block is U r ; and 
combining the hashed output with the decrypted image 
block U r 25 
[0056] Figure 1 1 shows a summary of the experimen- 
tal results summarizing the properties of the secret key 
verification methodology shown in Figures 1 A, 1 B. Sim- 
ilarly, Figure 12 shows a summary of the experimental 
results summarizing the properties of the public key ver- 30 
ification methodology shown in Figures 9A, 9B. Refer- 
ring to Figures 11 and 12, one way to accomplish 
ownership verification is to associate a user key with a 
watermark so that the desired watermark can only be 
extracted from a watermarked image with the appropri- 35 
ate user key. If the user performs the watermark extrac- 
tion procedure using either an incorrect key or with an 
image that was not watermarked, the user obtains an 
image that resembles random noise. 
[0057] The block diagrams and flowcharts shown in 40 
Figures 1A ( 1B, 1C, 2A, 2B, 9A, 9B, 10A, and 10B may 
be implemented in either hardware or in software or a 
combination of both. For example, referring to the block 
diagram in Figure 1 A, the computation of the hash func- 
tion (calculating a digest of values) could implemented 45 
in software, while the exclusive OR function 1 1 6 and the 
modification of a predetermined bit of the image block 
could be performed in hardware. Alternatively, in 
another embodiment, the implementation of the block 
diagram shown in Figure 1A could be implemented so 
entirely in software, wherein the software is stored on a 
computer readable media and is adapted to running on 
a computer system. 

[0058] Figure 13 shows a high-level block diagram of 
a computer system adapted to execute a software pro- 55 
gram implementing the steps of the watermark method- 
ology according to the present invention. Central 
processing unit (CPU) 1311 is coupled to a bus 1312 


which in turn is coupled to random access memory 
(RAM) 1313, read only memory (ROM) 1314, input/out- 
put (I/O) adapter 1315, a communications adapter 
1316, user interface adapter 1317, and display adapter 
1318. RAM 1313 and ROM typically hold user and sys- 
tem data and programs. Typically, a software program 
implementing the present invention will reside on a stor- 
age medium and will execute on the CPU. 
[0059] It is understood that the above description is 
intended to be illustrative and not restrictive. For exam- 
ple, the present invention provides watermarking tech- 
nique for embedding a digital identifier into an image 
X m n of M x N pixels, to form a watermarked image Y m n 
of the same size. In an alternative embodiment, the 
watermarked image is a different size than the image 
x m,n- Tn e scope of the invention should therefore be 
determined with reference to the appended claims, 
along with the full scope of equivalents to which such 
claims are entitled. 

Claims 

1. An electronic system for inserting a watermark into 
a digital image, comprising: 

a means for modifying at least one predeter- 
mined bit in an image block X r to a predeter- 
mined value, wherein the modified image block 
isX r ; 

a means for calculating a digest of values using 
a cryptographic hash function, wherein the out- 
put of the means for calculating a digest of val- 
ues is a hashed output, wherein the means for 
modifying at least one predetermined bit of the 
image block is electrically coupled to the 
means for calculating a digest of values; 

a means for combining the hashed output with 
a watermark, wherein the means for combining 
the hashed output with a watermark is electri- 
cally coupled to the means for calculating a 
digest of values, wherein the output of the 
means for combining is a combined image 
block; and 

a means for inserting a first image block into 
the modified image block X p wherein the 
means for inserting the first image block into 
the modified image block X r is electrically cou- 
pled to the means for modifying at least one 
predetermined bit of the image block. 

2. The electronic system recited in claim 1 wherein the 
first image block is the combined image block C r . 

3. The electronic system recited in claim 1 wherein the 
first image block is an encrypted image block W r 
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4. The electronic system recited in claim 2 wherein the 
means for combining the hashed output with a 
watermark is electrically coupled to the means lor 
inserting the first image block into the modified 
image block X r 

5. The electronic system recited in claim 1 wherein the 
means for modifying at least one predetermined bit 
modifies the LSB of the image block X r 

6. The electronic system recited in claim 1 wherein the 
means for combining the hashed output with a 
watermark is an XOR logic block. 

7. The electronic system recited in claim 1 wherein the 
means for modifying at least a predetermined bit to 
a predetermined value modifies the at least one 
predetermined bit independently for each color 
plane of the image block. 

8. The electronic system recited in claim 3 further 
including an encryption means, wherein the 
encryption means is electrically coupled to both the 
means for combining the hashed output with a 
watermark and the means for inserting a first image 
block into the modified image block X r 

9. An electronic system for extracting a watermark 
from a digital image comprising: 

a means for modifying at least a predetermined 
bit of the watermarked image to a predeter- 
mined value; 

means for extracting at least a predetermined 
bit from the watermarked image block; 

means for calculating a digest of values using a 
cryptographic hash function, wherein the out- 
put of the means for calculating a digest of val- 
ues using a cryptographic hash function is a 
hashed output, wherein the means for modify- 
ing at least a predetermined bit of the water- 
marked image is electrically coupled to the 
means for calculating a digest of values; and 

means for combining, wherein the means 
for combining is electrically coupled to the 
means for calculating a digest of values. 

10. The electronic system recited in claim 9 wherein the 
means for combining is electrically coupled to the 
means for extracting at least a predetermined bit 
from the watermarked image block. 

11. The electronic system recited in claim 9 further 
including a decryption means, wherein the decryp- 
tion means is electrically coupled to the means for 


extracting at least a predetermined bit from the 
watermarked image block and the means for com- 
bining. 

s 12. The electronic system recited in claim 9 wherein the 
means for modifying at least a predetermined bit to 
a predetermined value modifies the least significant 
bit of the image block. 

10 13. A method for inserting a watermark into a digital 
image including the steps of: 

partitioning the image block X r into at least one 
I xJ block: 

15 

for each I x J block, modifying at least a prede- 
termined bit of each I x J block to a predeter- 
mined value, wherein the modified image block 
is X r ; 

20 

calculating a digest of the values using a cryp- 
tographic hash function; 

combining the hashed output calculated in the 
25 previous step with a watermark bitmap 

wherein the output of the step of combining the 
hashed output with a watermark B r is a com- 
bined image block C r ; and 

30 inserting a first image block into the modified 

image X r 

14. The method recited in claim 13 wherein the first 
image block is the combined image block C r 

35 

15. The method recited in claim 13 wherein the first 
image block is an encrypted image block W P 

16. The method recited in claim 13 further including the 
40 step of encrypting the combined image block, 

wherein the result of encrypting the combined 
image block is the encrypted image block W r . 

17. The method recited in claim 13 wherein the at least 
45 one predetermined bit of the image block X r is mod- 
ified by discarding the predetermined bit. 

18. The method recited in claim 13 wherein the step of 
modifying at least one predetermined bit of the 

so image block X r a plurality of bits are modified by set- 
ting the predetermined pattern of bits to predeter- 
mined values. 
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PARTITION IMAGE INTO AT LEAST 
ONE BLOCK OF I x J PIXELS X r 


MODIFY EACH IMAGE BLOCK X 
MODIFY IMAGE BLOCK IS X r 


CALCULATE A DIGEST OF VALUES 
K,M,N,X r USING A 
CRYPTOGRAPHIC HASH 
FUNCTION TO CREATE A HASHED 
OUTPUT 


COMBINE THE HASHED OUTPUT 

WITH THE CORRESPONDING 
BLOCK OF THE WATERMARK B r « 
THE COMBINED IMAGE BLOCK IS 


INSERT THE COMBINED IMAGE 
BLOCK C r INTO THE MODIFIED 
B1T(S) OF X r 


Figure 1B 
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MODIFY EACH WATERMARKED 
IMAGE BLOCK Y r 


FOR EACH BLOCK, EXTRACT AT 

LEAST A PREDETERMINED BIT 
FROM THE WATERMARKED IMAGE 
BLOCK, OUTPUT IS E r 


1 


CALCULATE A DIGEST OF VALUES 

K.M.N.Y USING A 
CRYPTOGRAPHIC HASH FUNCTION 


COMBINE THE HASHED OUTPUT 
IMAGE WITH E r 


Figure 2B 
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PARTITION IMAGE 
OF 1 x 

X INTO BLOCKS 
J PIXELS r 




FOR EACH I x J PIXEL BLOCK, 
MODIFY AT LEAST A 
PREDETERMINED BIT TO A 

PREDETERMINED VALUE, 
MODIFIED IMAGE IS X r 




CALCULATE A DIGEST OF VALUES 

M,N,X r USING A 
CRYPTOGRAPHIC HASH FUNCTION 

1 



COMBINE THE HASHED OUTPUT 
WITH A CORRESPONDING BLOCK, 
OF THE WATERMARK B r , THE r 
COMBINED IMAGE BLOCK IS C r 




ENCRYPT THE COMBINED IMAGE 
BLOCK, ENCRYPTED IMAGE IS W r 
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INSERT W INTO THE MODIFIED 
IMAGE X r 
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FOR EACH I x J BLOCK, MODIFY AT 
LEAST PREDETERMINED BIT OF 
A WATERMARKED IMAGE Z r , 
MODIFIED IMAGE IS Z r 


1050 


CALCULATE A DIGEST OF VALUES 
M, N, Z r USING A CRYPTOGRAPHIC 
HASH FUNCTION, OUTPUT IS Q r 


FOR EACH BLOCK, EXTRACT AT 

LEAST A PREDETERMINED BIT 
FROM THE WATERMARKED IMAGE 
Z r . OUTPUT IS Gr 
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WITH THE DECRYPTED IMAGE U r , 
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